secuvera GmbH 
			  (former Tele-Consulting GmbH
			security | networking | training)

				advisory 05/07/06

			      last update 06/04/04


URL of this advisory:
http://pentest.tele-consulting.com/advisories/05_07_06_voip-phones.txt


Topic:
	Weakness in implemenation of proccessing SIP-Notify-Messages
	in VoIP-Phones.

Summary:
	Due to ignoring the value of 'Call-ID' and even 'tag' and
	'branch' while processing NOTIFY messages, VoIP-Hardphones
	process spoofed status messages like "Messages-Waiting".

	According to RFC 3265, Chap 3.2 every NOTIFY has to be em-
	bedded in a subcription mechanism. If there ain't knowledge
	of a subscription, the UAC has to respond with a "481
	Subscription does not exist" message.

	All tested phones processed the "Messages-Waiting" messages
	without prior subscriptions anywhere.

Effect:
	An attacker could send "Messages-Waiting: yes" messages to
	all phones in a SIP-environment. Almost every phone proccesses
	this status message and shows the user an icon or a blinking
	display to indicate that new messages are available on the
	voice box.

	If the attacker sends this message to many recipients in a
	huge environment, it would lead to server peaks as many users
	will call the voice box at the same time.
	Because there are no new voice messages as indicated by the
	phone the users will call the support to fix this alleged server
	problem.

	All tested phones process the message with a resetted Call-ID,
	'branch' and 'tag' sent by a spoofed IP-Adress.

Example:
	Attacker spoofs the SIP-Proxys IP, here: 10.1.1.1
	Victim 10.1.1.2

	UDP-Message from Attacker to Victim

	Session Initiation Protocol
	     Request-Line: NOTIFY sip:login@10.1.1.2 SIP/2.0
	     Message Header
 	        Via: SIP/2.0/UDP 15.1.1.12:5060;branch=000000000000000
 	        From: "asterisk" <sip:asterisk@10.1.1.1>;tag=000000000
 	        To: <sip:login@10.1.1.2>
  	        Contact: <sip:asterisk@10.1.1.1>
          	Call-ID: 00000000000000@10.1.1.1
         	CSeq: 102 NOTIFY
       	  	User-Agent: Asterisk PBX
          	Event: message-summary
          	Content-Type: application/simple-message-summary
          	Content-Length: 37
     	Message body
          	Messages-Waiting: yes\n
          	Voicemail: 3/2\n

Exploit:
	Tele-Consulting has released a tiny script to exploit this 
	vulnerabilty half automated (e. g. on Class-C ranges or single
	IPs). It is licenced under GPL and published on this website:
	http://www.security-scans.de/index.php?where=ssf

Solution:
	Phones who receive a NOTIFY message to which no subscription
	exists, must send a "481 Subscription does not exist" response.
	It should be possible to use the REGISTER request as a
	non-SUBSCRIBE mechanism to set up a valid subscription.

	This would reduce the possibility of an attack in a way, that
	only with a sniffed and spoofed subcription such an attack would
	be possible. Background is given by the way dialogs are des-
	cribed in RFC 3261 and the sections 5.5 and 3.2 of RFC 3265.


Affected products:
	Cisco 7905/7940/7960
	Grandstream BT 100

	Vulnerability in Avaya Softphones reported in the voipsec 
	mailing list (voipsa.org) by Mark Teicher could not be verified.
	
	For a list of more phones reported vulnerable please go to the 
	following website:
	http://www.security-scans.de/index.php?where=ssf

Credits:
        Tobias Glemser (tglemser@secuvera.de)
        secuvera GmbH, Germany (former Tele-Consulting security networking training GmbH)
        www.secuvera.de